An app token is a unique key that allows you to securely interact with the Sumsub API and sign your API calls.

With Sumsub app tokens, you can configure permissions to control which API calls can be made using them. The app tokens enable you to perform various actions such as creating applicants, uploading documents, monitoring verification statuses, and so on through our API.

By default, an app token does not have an expiration period, so it provides unlimited access to the Sumsub API within the permissions set for it — however, you can optionally set an expiration date for a token when generating it, after which it automatically switches to the Expired status.

Generate app token

To generate a token:

1. In the Dashboard, open Dev space, go to the App Tokens page, and click Generate app token.
2. In the Name field, enter a preferred token name.
3. In the Whitelisted IPs section, specify whether this token can be used from any IP address (default), or restrict its usage to specific trusted addresses, which you provide as a comma-separated list.
4. [Optionally] From the Source keys from client drop-down list, choose a source key, if you have created it previously. In case there are no available source keys and you want the app token to have access only to a specific group of applicants, refer to this article to learn how to set one up.

   📘

   Note

   Each source key you request must already exist on your account. If you pass a source key that has not been created, the request is rejected with a 403 error and the message Unable to extend source keys.

5. [Optionally] Specify an expiration date for the app token.
6. Select permissions by setting corresponding checkboxes according to your preferences. Different permission types allow you to configure how you want to moderate, view, and manage your applicants’ verification or transactions. You can also click Select all to choose all permissions at once.
7. Click Generate app token. Consider that once you create an app token, you cannot change the token’s settings.
8. Save the token and secret key to a secure location, as they are displayed only once, and confirm it by clicking I’ve saved app token and key securely.

View app tokens

Open the Dev space → App Tokens section to view information about all tokens created on your key, including their name, status, created date, and usage count. The Usage column shows the number of requests made using each token over the last 30 days.

To find a specific token, use the search field or narrow down the results using the following filters:

• Permissions — filters tokens by the permissions assigned to them.
• Status — filters tokens by their current status: Enabled, Disabled, or Expired.
• Author — filters tokens by the user who created them.
• Source key — filters tokens by the source key they are associated with.

You can also click the filter icon next to the Created column heading to sort tokens by creation date.

Click a token in the list to expand additional details, including its Permissions, Whitelisted IPs, and Source keys sections.

Manage app tokens

You can manage app tokens by clicking the three-dot menu next to the corresponding token and selecting the following options:

• Enable or disable a token. When disabling a token, you will be prompted to specify a reason.
• Delete a token.